Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I have an HTML form, with more than 30 fields in it. When this form is submitted to the server, all of the values of the fields should be trimmed. In other words, no value should start/end with any kind of whitespace (\b).

There are many options available for me:

  1. Manually trim each value
  2. Looping over values and trim each one
  3. Creating a framework (something like ASP.NET's HTTP Module) to sit at the way of any HTTP Post request, to trim the incoming value.

The third option seems the best one. However, I don't know if it is really the best one or not? And I also don't know how to do it. Is it possible at all? What are other solutions?

share|improve this question

2 Answers 2

If you don't really care about security you may consider trimming the fields with Javascript when the form submit button is clicked (event *onsubmit" to implement). Now, this is of course easily bypassable since it's client server code.

Otherwise, for a server-side solution, all your solutions work. I'm not sure about the module but I think it will perform this trimming for all applications on the server, right? So you may consider that factor if your application is not the only one deployed.

Finally, but you may have considered that already, you can properly do the trimming using HTTP request listeners.

In J2EE (or whatever it is called now), it would consist in implementing your own ServletRequestListener and requestInitialized method. The advantage here is that you can package this listener in a simple JAR and add it (and its configuration in web.xml) only for the applications that require that.

In .NET, it would consist in overriding the Application_BeginRequest method in Global.asax.cs. So it would work only for the application you wrote the code for.

share|improve this answer
1  
Not caring for security on an intranet is a incredibly stupid thing to do. Threat from inside are a non negligible and usually has a bigger impact. –  deadalnix Oct 26 '11 at 10:25
    
That's why I wrote "if you don't really care about security" but I'll remove the Intranet application mention and give you a +1. –  Jalayn Oct 26 '11 at 10:33

It's very common to "clean/rinse" incoming data. This is best handled server-side, typically by the method you are POSTing to (you may have a static helper to do the actual work).

Writing a module to intercept all requests seems like overkill (but effective if you need this application- or server-wide).

You don't mention a technology but in ASP.NET MVC, it would look something like:

[HttpPost]
public ActionResult Index(FormCollection form)
{
    foreach (var field in form.AllKeys)
        form[field] = form[field].Trim();

    return View();
}

So, I guess I'm going with option #2, server-side!

Edit: just changed my bogus Regex.Replace() call to String.Trim()

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.